GDPR FAQ

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that gives you control over your personal data. It requires organizations to be transparent about how they collect, use, and protect your information, and gives you specific rights to access, correct, or delete your data. In healthcare contexts, GDPR provides additional protections for sensitive health information.

The cookie banner appears because UK GDPR requires us to obtain your explicit consent before using non-essential cookies. Essential cookies (needed for the website to work) don't require consent, but analytics, marketing, and preference cookies do. The banner lets you choose which types of cookies you're comfortable with.

Yes! You can use our healthcare directory with only essential cookies enabled. You'll still be able to request a match, book appointments, and access all core features. However, some personalized features like saved preferences and analytics to improve our services may not be available.

You can change your cookie preferences at any time by clicking the privacy button (CO icon) in the bottom-left corner of your screen, visiting our Cookie Policy page, or updating your preferences in your account settings. Changes take effect immediately.

We keep different types of data for different periods based on legal requirements and business needs. Account data is kept while your account is active plus 7 years for legal compliance. Health-related data follows medical record retention requirements. Analytics data is anonymized after 26 months. You can request deletion of your data at any time, subject to legal requirements.

Your data is only accessible to authorized personnel who need it for legitimate purposes. This includes our support team (for account assistance), healthcare providers (for the match we make and any appointment that follows), and technical staff (for system maintenance). We never sell your data to third parties. All access is logged and monitored for security.

We only share health information with a practitioner once we have matched you with them and you book an appointment. We never share your health data with advertisers, marketers, or other third parties without your explicit consent. All data sharing is clearly explained in our Privacy Policy and you can control it through your account settings.

We use industry-standard security measures including encryption, secure servers, regular security audits, and staff training. All data is encrypted in transit and at rest. We have incident response procedures and will notify you immediately if any breach affects your data. We also comply with healthcare data security standards.

Healthcare providers only see information you choose to share when booking an appointment, such as your name, contact details, and any health information you provide. They cannot see your other match requests, other appointments, or personal preferences unless you specifically share this information.

We do not store your complete medical records. We only store information you provide when using our service, such as appointment bookings, provider preferences, and any health information you choose to share. Your actual medical records remain with your healthcare providers.

In genuine medical emergencies, we may share relevant health information with emergency services if it could save your life or prevent serious harm. This would only happen with appropriate legal authority and we would notify you as soon as possible. This is an exception to normal data sharing practices.

You can delete your account through your account settings or by emailing privacy@thehealthnav.co.uk with "Account Deletion Request" in the subject line. We'll delete your account and personal data within 30 days, though some information may be retained for legal compliance or to prevent fraud.

You can request a copy of all your personal data by emailing privacy@thehealthnav.co.uk with "Subject Access Request" in the subject line. We'll provide your data in a readable format (PDF, CSV, or JSON) within 30 days. This includes all personal information, preferences, and usage data we hold about you.

You can correct inaccurate information through your account settings or by contacting us at privacy@thehealthnav.co.uk. For health-related information, we may need to verify the correction with healthcare providers. We'll update your information within 30 days and notify any relevant parties.

You can unsubscribe from marketing emails by clicking the unsubscribe link in any email, updating your preferences in your account settings, or emailing privacy@thehealthnav.co.uk. You'll still receive important service-related communications about your appointments and account.

We use trusted third-party services including Google Analytics (for website performance), Firebase (for authentication and analytics), and Mapbox (for maps). All third parties are bound by strict data protection agreements and only process your data as necessary for our services.

Some of our service providers may process data outside the UK, but only with appropriate safeguards in place. We ensure all international transfers comply with UK GDPR requirements through standard contractual clauses, adequacy decisions, or other approved transfer mechanisms.

We may use automated systems to recommend healthcare providers, personalize content, or detect fraud. You have the right to request human review of any automated decision that significantly affects you. You can also opt out of profiling for marketing purposes.

We process your data based on several legal grounds: consent (for marketing and analytics), contract performance (for providing our services), legitimate interests (for service improvement and security), and legal obligations (for healthcare compliance). Each type of processing has a specific legal basis explained in our Privacy Policy.

If you're not satisfied with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We encourage you to contact us first so we can try to resolve your concerns directly.

Yes, we have a Data Protection Officer who oversees our data protection compliance. You can contact them at privacy@thehealthnav.co.uk for any data protection concerns, questions about your rights, or to make formal requests regarding your personal data.